Gpac Mp4box

GPAC MP4Box <2.5 NULL Pointer Deref in gf_ac4_presentation_ch_mode Causing DoS
CVE-2025-60469 - October 21, 2026

A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

GPAC MP4Box v<2.5: Use-After-Free Causing DOS via AC4 File
CVE-2025-60476 - October 21, 2026

A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

Use-After-Free in GPAC MP4Box <2.5 gf_filter_packet_destroy DoS
CVE-2025-60478 - October 21, 2026

A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.

GPAC MP4Box <=2.5 DoS via NULL ptr in StatSFVec2f
CVE-2025-60479 - October 21, 2026

A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.

GPAC MP4Box <2.5 Segfault via gf_isom_get_esd (CVE-2025-60487)
CVE-2025-60487 - October 21, 2026

A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.

GPAC MP4Box <2.5 NULL Pointer Deref in dasher_insert_timeline_entry (DoS)
CVE-2025-60489 - October 21, 2026

A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

GPAC MP4Box <2.5 Heap UAF in gf_filter_pid_send_event_downstream: DoS
CVE-2025-60490 - October 21, 2026

A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

GPAC MP4Box <2.5 Heap UAF in dasher_flush_segment causes DoS
CVE-2025-60491 - October 21, 2026

A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

GPAC MP4Box <2.5 Stack Overflow in gf_bifs_dec_node Causes DoS
CVE-2025-60492 5.5 - Medium - October 21, 2026

A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Stack Overflow

GPAC MP4Box 2.4 Segmentation Violation in check_media_profile DoS
CVE-2025-60493 - October 21, 2026

A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

GPAC MP4Box <2.5 DoS via GetESD segfault
CVE-2025-60497 5.5 - Medium - October 21, 2026

A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Buffer Overflow

MP4Box prev26.07.0: OOB Read gf_odf_ac4_cfg_dsi_v1 DoS
CVE-2025-71438 - October 21, 2026

An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

GPAC MP4Box FPE DoS before 2.5 via Reframer_Send_Pkt
CVE-2025-60496 - October 20, 2026

A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

DoS via Segfault in GPAC MP4Box <2.5
CVE-2025-60494 - October 20, 2026

A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.

GPAC MP4Box Buffer Overflow (gf_ac4_parser_bs) before 2.5
CVE-2025-60475 - October 20, 2026

A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

GPAC MP4Box 2.5-DEV: Heap UAF in gf_odf_ac4_cfg_clean_list
CVE-2025-60482 - October 19, 2026

A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

GPAC MP4Box v2.4 Use-After-Free in gf_filter_pid_get_packet Causing DoS
CVE-2025-55654 5.5 - Medium - October 19, 2026

A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.

Dangling pointer

Segmentation Violation in GPAC MP4Box v2.5-DEV via dump_isom_saps Causing DoS
CVE-2025-55667 5.5 - Medium - October 19, 2026

A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Buffer Overflow

GPAC MP4Box stbl_AddSize Heap Overflow (v2.4) Allows DoS via MP4
CVE-2025-55640 - October 16, 2026

A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

GPAC MP4Box v2.4 DPZ FP exception in utils/error.c parse_lfrac
CVE-2025-55653 5.5 - Medium - October 16, 2026

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, terminating the process with SIGFPE.

Divide By Zero

Use-After-Free causing DoS in MP4Box before 26.02.0 via crafted MPEG-2 TS
CVE-2025-60464 7.8 - High - June 25, 2026

A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 TS file.

Dangling pointer

GPAC MP4Box < v26.02.0 UF in gf_filter_pid_inst_swap causing DoS
CVE-2025-60465 6.1 - Medium - June 25, 2026

A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

Dangling pointer

Use-after-free in gf_filter_pid_get_packet (MP4Box <26.02.0) leads to DoS
CVE-2025-60466 5 - Medium - June 24, 2026

A use-after-free in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

Dangling pointer

Use-After-Free in MP4Box <26.02.0 Causing DoS via Crafted Media
CVE-2025-60467 7.5 - High - June 24, 2026

A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

Dangling pointer

GPAC MP4Box <2.5DEV> UseAfterFree via PID Swap/Delete (buffer overflow)
CVE-2025-60468 5.5 - Medium - June 24, 2026

GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. The impact is: cause a denial of service (local). The component is: filter_core/filter_pid.c (L:574-580): function gf_filter_pid_inst_swap_delete_task() improperly accesses freed objects during PID instance swap/delete cleanup, leading to heap use-after-free. The attack vector is: Local (AV:L): a local, authenticated user who processes a specially crafted MPEG-2 TS/MP4 file with MP4Box can trigger the bug during filter teardown (PID instance swap/delete), causing a crash. ¶¶ In GPAC s MP4Box, gf_filter_pid_inst_swap_delete_task() in filter_core/filter_pid.c may dereference objects after they have been freed when cleaning up PID instances after a swap/delete operation. Crafted inputs (e.g., malformed MPEG-2 TS) can trigger a heap use-after-free and crash; exploitation may be possible.

Heap-based Buffer Overflow

GPAC MP4Box DoS via useafterfree before 26.02.0
CVE-2025-60471 5.5 - Medium - June 24, 2026

A use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

Dangling pointer

MP4Box <26.02: NULL Pointer Deref in gf_filter_in_parent_chain Leads to DoS
CVE-2025-60473 5.5 - Medium - June 24, 2026

A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.

NULL Pointer Dereference

GPAC MP4Box <26.02.0 Buffer Overflow in gf_media_import Causes DoS
CVE-2025-60474 7.5 - High - June 24, 2026

A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Stack Overflow

GPAC MP4Box v2.4 NULL Ptr Deref DoS via crafted MP4
CVE-2025-55639 6.5 - Medium - June 23, 2026

GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

NULL Pointer Dereference

GPAC MP4Box v2.4 Heap UAF in gf_node_get_tag Causes DoS
CVE-2025-55650 5.5 - Medium - June 15, 2026

A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Dangling pointer

GPAC MP4Box v2.4 DoS via NULL deref in gf_isom_copy_sample_info
CVE-2025-55641 5.5 - Medium - June 15, 2026

A NULL pointer dereference in the gf_isom_copy_sample_info function (isomedia/isom_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

NULL Pointer Dereference

GPAC MP4Box v2.4 FP Exception in avidmx_process
CVE-2025-55642 6.5 - Medium - June 15, 2026

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c).

Divide By Zero

GPAC MP4Box v2.4 NULL PTR DEREF DoS via crafted MP4 (TrackWriter)
CVE-2025-55643 5.5 - Medium - June 15, 2026

A NULL pointer dereference in the TrackWriter handling component (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

NULL Pointer Dereference

GPAC MP4Box v2.4 Heap UAF in gf_node_get_tag allows DoS
CVE-2025-55644 5.5 - Medium - June 15, 2026

A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Dangling pointer

Heap Buffer Overflow in GPAC MP4Box v2.4 (gf_cenc_set_pssh) Enables DoS
CVE-2025-55645 5.5 - Medium - June 15, 2026

A heap buffer overflow in the gf_cenc_set_pssh function (isomedia/drm_sample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Heap-based Buffer Overflow

GPAC MP4Box OOM via mp4_mux_cenc_insert_pssh (v2.4) DoS
CVE-2025-55647 5.5 - Medium - June 15, 2026

An Out-of-Memory in the mp4_mux_cenc_insert_pssh function (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Integer Overflow or Wraparound

GPAC MP4Box v2.4 Heap Buffer Overflow in gf_opus_parse_packet_header DoS
CVE-2025-55648 5.5 - Medium - June 15, 2026

A heap buffer overflow in the gf_opus_parse_packet_header function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Heap-based Buffer Overflow

GPAC MP4Box v2.4 DoS via NULL ptr in gf_media_map_esd
CVE-2025-55649 5.5 - Medium - June 15, 2026

A NULL pointer dereference in the gf_media_map_esd function (media_tools/isom_tools.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

NULL Pointer Dereference

GPAC MP4Box v2.4 Heap Buffer Overflow in gf_isom_vp_config_new
CVE-2025-55652 5.5 - Medium - June 15, 2026

A heap buffer overflow in the gf_isom_vp_config_new function (isomedia/avc_ext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Heap-based Buffer Overflow

GPAC MP4Box v2.4 DOS via gf_opus_read_length stack overflow
CVE-2025-55660 5.5 - Medium - June 15, 2026

A stack overflow in the gf_opus_read_length function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Stack Overflow

Heap buffer overflow in GPAC MP4Box 2.4 Opus parser causes DoS
CVE-2025-55661 5.5 - Medium - June 15, 2026

A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Heap-based Buffer Overflow

GPAC MP4Box v2.4 DoS via Segfault in Track_SetStreamDescriptor
CVE-2025-55663 5.5 - Medium - June 15, 2026

A segmentation violation in the Track_SetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

NULL Pointer Dereference

GPAC MP4Box v2.4 Stack Buffer Overflow (DoS)
CVE-2025-52292 7.5 - High - June 09, 2026

A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Stack Overflow

Segmentation Fault in GPAC MP4Box v2.4 Fails via HEVC SPS causing DoS
CVE-2025-52293 7.5 - High - June 09, 2026

A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying crafted HEVC SPS data.

Resource Exhaustion

GPAC MP4Box v2.4 NULL pointer in gf_isom_get_user_data_count causes DoS
CVE-2025-55651 5.5 - Medium - June 09, 2026

A NULL pointer dereference in the gf_isom_get_user_data_count function (isomedia/isom_read.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

NULL Pointer Dereference

GPAC MP4Box v2.4 NULL ptr deref in gf_odf_vvc_cfg_write_bs causes DoS
CVE-2025-55657 7.5 - High - June 09, 2026

A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

NULL Pointer Dereference

GPAC MP4Box v2.4 FP Exception DoS via gf_opus_parse_packet_header
CVE-2025-55658 6.5 - Medium - June 09, 2026

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_opus_parse_packet_header function (media_tools/av_parsers.c). bThis vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

Floating Point Comparison with Incorrect Operator

GPAC MP4Box v2.4 NULL PTR DoS via Crafted MP4 (ctts_box_write)
CVE-2025-55659 6.5 - Medium - June 09, 2026

A NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

NULL Pointer Dereference

GPAC MP4Box <=26.02.0 NULL Ptr Deref DoS via gf_filter_pid_resolve_file
CVE-2025-60477 5 - Medium - June 03, 2026

A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.

NULL Pointer Dereference

GPAC MP4Box <26.02.0 Segfault in gf_isom_apple_set_tag_ex(DOS)
CVE-2025-60485 5.5 - Medium - June 01, 2026

A segmentation violation in the gf_isom_apple_set_tag_ex function (/isomedia/isom_write.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

NULL Pointer Dereference